8000 GH-95494: Fix transport EOF handling in OpenSSL 3.0 (GH-95495) · python/cpython@420bbb7 · GitHub
[go: up one dir, main page]
Skip to content

Commit 420bbb7

Browse files
davidbendavidben
authored
GH-95494: Fix transport EOF handling in OpenSSL 3.0 (GH-95495)
GH-25309 enabled SSL_OP_IGNORE_UNEXPECTED_EOF by default, with a comment that it restores OpenSSL 1.1.1 behavior, but this wasn't quite right. That option causes OpenSSL to treat transport EOF as the same as close_notify (i.e. SSL_ERROR_ZERO_RETURN), whereas Python actually has distinct SSLEOFError and SSLZeroReturnError exceptions. (The latter is usually mapped to a zero return from read.) In OpenSSL 1.1.1, the ssl module would raise them for transport EOF and close_notify, respectively. In OpenSSL 3.0, both act like close_notify. Fix this by, instead, just detecting SSL_R_UNEXPECTED_EOF_WHILE_READING and mapping that to the other exception type. There doesn't seem to have been any unit test of this error, so fill in the missing one. This had to be done with the BIO path because it's actually slightly tricky to simulate a transport EOF with Python's fd based APIs. (If you instruct the server to close the socket, it gets confused, probably because the server's SSL object is still referencing the now dead fd?)
1 parent 7b2d53d commit 420bbb7

File tree

3 files changed

+32
-7
lines changed

3 files changed

+32
-7
lines changed

‎Lib/test/test_ssl.py

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,6 @@ def data_file(*name):
151151
OP_SINGLE_ECDH_USE = getattr(ssl, "OP_SINGLE_ECDH_USE", 0)
152152
OP_CIPHER_SERVER_PREFERENCE = getattr(ssl, "OP_CIPHER_SERVER_PREFERENCE", 0)
153153
OP_ENABLE_MIDDLEBOX_COMPAT = getattr(ssl, "OP_ENABLE_MIDDLEBOX_COMPAT", 0)
154-
OP_IGNORE_UNEXPECTED_EOF = getattr(ssl, "OP_IGNORE_UNEXPECTED_EOF", 0)
155154

156155
# Ubuntu has patched OpenSSL and changed behavior of security level 2
157156
# see https://bugs.python.org/issue41561#msg389003
@@ -958,8 +957,7 @@ def test_options(self):
958957
# SSLContext also enables these by default
959958
default |= (OP_NO_COMPRESSION | OP_CIPHER_SERVER_PREFERENCE |
960959
OP_SINGLE_DH_USE | OP_SINGLE_ECDH_USE |
961-
OP_ENABLE_MIDDLEBOX_COMPAT |
962-
OP_IGNORE_UNEXPECTED_EOF)
960+
OP_ENABLE_MIDDLEBOX_COMPAT)
963961
self.assertEqual(default, ctx.options)
964962
with warnings_helper.check_warnings():
965963
ctx.options |= ssl.OP_NO_TLSv1
@@ -2120,6 +2118,20 @@ def test_bio_read_write_data(self):
21202118
self.assertEqual(buf, b'foo\n')
21212119
self.ssl_io_loop(sock, incoming, outgoing, sslobj.unwrap)
21222120

2121+
def test_transport_eof(self):
2122+
client_context, server_context, hostname = testing_context()
2123+
with socket.socket(socket.AF_INET) as sock:
2124+
sock.connect(self.server_addr)
2125+
incoming = ssl.MemoryBIO()
2126+
outgoing = ssl.MemoryBIO()
2127+
sslobj = client_context.wrap_bio(incoming, outgoing,
2128+
server_hostname=hostname)
2129+
self.ssl_io_loop(sock, incoming, outgoing, sslobj.do_handshake)
2130+
2131+
# Simulate EOF from the transport.
2132+
incoming.write_eof()
2133+
self.assertRaises(ssl.SSLEOFError, sslobj.read)
2134+
21232135

21242136
@support.requires_resource('network')
21252137
class NetworkedTests(unittest.TestCase):

‎Misc/NEWS.d/next/Library/2022-07-30-23-01-43.gh-issue-95495.RA-q1d.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
When built against OpenSSL 3.0, the :mod:`ssl` module had a bug where it
2+
reported unauthenticated EOFs (i.e. without close_notify) as a clean TLS-level
3+
EOF. It now raises :exc:`~ssl.SSLEOFError`, matching the behavior in previous
4+
versions of OpenSSL. The :attr:`~ssl.SSLContext.options` attribute on
5+
:class:`~ssl.SSLContext` also no longer includes
6+
:data:`~ssl.OP_IGNORE_UNEXPECTED_EOF` by default. This option may be set to
7+
specify the previous OpenSSL 3.0 behavior.

‎Modules/_ssl.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -660,6 +660,16 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
660660
ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
661661
type = state->PySSLCertVerificationErrorObject;
662662
}
663+
#if defined(SSL_R_UNEXPECTED_EOF_WHILE_READING)
664+
/* OpenSSL 3.0 changed transport EOF from SSL_ERROR_SYSCALL with
665+
* zero return value to SSL_ERROR_SSL with a special error code. */
666+
if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
667+
ERR_GET_REASON(e) == SSL_R_UNEXPECTED_EOF_WHILE_READING) {
668+
p = PY_SSL_ERROR_EOF;
669+
type = state->PySSLEOFErrorObject;
670+
errstr = "EOF occurred in violation of protocol";
671+
}
672+
#endif
663673
break;
664674
}
665675
default:
@@ -3092,10 +3102,6 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
30923102
#endif
30933103
#ifdef SSL_OP_SINGLE_ECDH_USE
30943104
options |= SSL_OP_SINGLE_ECDH_USE;
3095-
#endif
3096-
#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
3097-
/* Make OpenSSL 3.0.0 behave like 1.1.1 */
3098-
options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
30993105
#endif
31003106
SSL_CTX_set_options(self->ctx, options);
31013107

0 commit comments

Comments
 (0)
0